Browser and build plumbing got the kind of attention that usually only arrives after something catches fire. WebKit finally rebuilt Safari's module loader to fix top-level await properly, Zod 4.6 brings a much faster validate(), and GitHub shared the very real edge cases behind porting Copilot's runtime from Node to Rust without stopping the train. On the database side, Postgres 19 plan advice looks like a new lever for taming stubborn query plans, while WalShadow streams physical WAL into ClickHouse with near-real-time latency.
Meanwhile, the agents continued to stress-test civilization. rubyhack.ai reports an agent-driven RubyGems supply-chain attack, F5 Labs documents mass scanning of exposed Vite dev servers for .env loot, and Anthropic explains how agentic coding caused a 25x CI-job spike that forced a rethink of test impact analysis. If the mood here is "please add guardrails before the demo," that is because the week earned it.
Tooling, thankfully, stayed constructive. @shadcn/lint targets the exact Tailwind and design-system messes agents love to generate, modern-web-types ships browser-early DOM typings before lib.dom catches up, and fallow promises dead-code and complexity detection with zero config. Altogether: better runtimes, sharper database knobs, and a growing pile of evidence that the real AI platform work happens in the infrastructure around the model.
Enjoy!
Signup here for the newsletter to get the weekly digest right into your inbox.
Find the 11 highlighted links of weeklyfoo #155:
Fixing top-level await in Safari
by WebKit Blog
WebKit rewrote Safari's module loader in native C++ after the old one relied on the abandoned 2016 WHATWG Loader proposal, fixing top-level await and an import-order bug
📰 Good to know, javascript,safari,webkit
OpenAI agents carried out an undisclosed cyberattack on RubyGems
by rubyhack.ai
Researchers attribute a May campaign of 2000+ malicious packages to an agent swarm that abused RubyDoc.info builds for remote execution
📰 Good to know, security,supply-chain,ai
Agentic coding is straining CI, here's how Anthropic scaled test impact analysis
by Anthropic
A 25x jump in CI jobs in six months broke a singleton test selection service, replaced by stateless listener workers, an in-memory journal and a separate rollup consumer
📰 Good to know, ci,testing,ai
Mass scanning for exposed Vite dev servers
by F5 Labs
Attackers exploit a server.fs.deny bypass to pull credentials from .env files, patched in Vite 7.3.2 and 8.0.5
📰 Good to know, security,vite
Zod 4.6
by Zod
Adds validate(), a boolean check up to 35x faster than safeParse().success on invalid input with compiled schemas
📰 Good to know, typescript,validation
Plan advice in Postgres 19
by Dimitri Fontaine
pg_plan_advice and pg_stash_advice capture planner advice, enforce it selectively and apply it automatically by query id
📰 Good to know, postgres,database
Why GitHub ported Copilot's runtime from Node to Rust
by GitHub Blog
Ported piece by piece behind napi-rs shims while shipping daily, with the real lessons hiding in number types, logical-or semantics and a blocked event loop
📰 Good to know, rust,nodejs,performance
@shadcn/lint
by shadcn
Agent-first linter for Tailwind design systems that works with existing systems without a rewrite
🧰 Tools, tailwind,lint,ai
modern-web-types
by Philip Walton
Drop-in lib.dom replacement adding TypeScript types for APIs shipped in only one browser engine, like element-scoped startViewTransition
🧰 Tools, typescript,web,types
fallow
by Bart Waardenburg
Zero-config Rust binary that finds dead code, duplication, circular dependencies and complexity hotspots in JS and TS projects
🧰 Tools, typescript,lint,tooling
WalShadow
by ClickHouse
Replicates Postgres into ClickHouse from the physical WAL instead of logical decoding, at roughly 200ms commit-to-visible latency
🧰 Tools, postgres,clickhouse,opensource
Want to read more? Check out the full article here.
To sign up for the weekly newsletter, visit weeklyfoo.com.
Top comments (0)